xworm | 8216fb31e6a6eb3fe821086dd4d11648002c5be52dd239cd49ee0174b3e81eac

General

Target

Catlavan.exe
Size

74KB
MD5

cafec0e0f7eab47ab7cf90a1dd593f4f
SHA1

76c66c7232dac83c1ac2726ceff034591aa447cb
SHA256

05e568b534ae869db91152a0190d41a1bef9492bce1a06a46bc1fd76617dd0a5
SHA512

0b359db626ba17af3d10802927f2785f05e23f21079e2313c2ad32e5cef94c9e27ff0b810cee7d9a65fb66ae15462c18860570a62a8fdd12529d57043d08d498
SSDEEP

1536:zNx7MEFOzuMuQmN3+bTtdTEhakV0r6L5yhbsGOBR8X7Xwci:YaOqMuQg+bTjEV0YyljOBOXEci

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:30540

take-continually.gl.at.ply.gg:30540

Attributes

Install_directory
%AppData%
install_file
WindowsDefender.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2332-1-0x0000000000030000-0x0000000000048000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2104	powershell.exe
2648	powershell.exe
2704	powershell.exe
2068	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.lnk	Catlavan.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.lnk	Catlavan.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsDefender.exe"	Catlavan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2704	powershell.exe
2068	powershell.exe
2104	powershell.exe
2648	powershell.exe
2332	Catlavan.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2332	Catlavan.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	2068	powershell.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	2332	Catlavan.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2332	Catlavan.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2704	2332	Catlavan.exe	30
PID 2332 wrote to memory of 2704	2332	Catlavan.exe	30
PID 2332 wrote to memory of 2704	2332	Catlavan.exe	30
PID 2332 wrote to memory of 2068	2332	Catlavan.exe	32
PID 2332 wrote to memory of 2068	2332	Catlavan.exe	32
PID 2332 wrote to memory of 2068	2332	Catlavan.exe	32
PID 2332 wrote to memory of 2104	2332	Catlavan.exe	34
PID 2332 wrote to memory of 2104	2332	Catlavan.exe	34
PID 2332 wrote to memory of 2104	2332	Catlavan.exe	34
PID 2332 wrote to memory of 2648	2332	Catlavan.exe	36
PID 2332 wrote to memory of 2648	2332	Catlavan.exe	36
PID 2332 wrote to memory of 2648	2332	Catlavan.exe	36

C:\Users\Admin\AppData\Local\Temp\Catlavan.exe
"C:\Users\Admin\AppData\Local\Temp\Catlavan.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Catlavan.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Catlavan.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsDefender.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsDefender.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
3cf239e76193a2911b2bed2a89384a6e

SHA1
a1594579ce459629f7d911d298f1ae6e556c0674

SHA256
27c74f7715eae9a3505b9d1ade6cc86376b3371f935200eb5ff5eb26345bf415

SHA512
739b467f8011a9555a3f18b8cbfa4f12796b6cc4b9d3f647d8e2de9847d6f515b53279dbc287e2b6a9e7baf9e34a8d0292c8ea248a59ee2b9016b924a4b25a23

Download Submit
memory/2068-14-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/2068-15-0x00000000021D0000-0x00000000021D8000-memory.dmp

Filesize
32KB

Download
memory/2332-0-0x000007FEF5E73000-0x000007FEF5E74000-memory.dmp

Filesize
4KB

Download
memory/2332-1-0x0000000000030000-0x0000000000048000-memory.dmp

Filesize
96KB

Download
memory/2332-32-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download
memory/2332-33-0x000000001B1D0000-0x000000001B250000-memory.dmp

Filesize
512KB

Download
memory/2704-6-0x00000000028C0000-0x0000000002940000-memory.dmp

Filesize
512KB

Download
memory/2704-7-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2704-8-0x00000000026E0000-0x00000000026E8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads